Privacy Policy

1. Two kinds of data, two roles

• Your account data: your name, email, password and business details. We decide how this is used, so we are the data controller.
• Your customers' data: the names, emails, phone numbers and addresses you put on quotations and invoices. You decide how this is used, so your business is the controller and we process it on your behalf, only to provide Usetally, under our Data Processing Agreement.

2. What we collect

• Account details: name, email address, password (stored securely by our login provider; we never see it in plain text).
• Business details: business name, address, phone, tax ID, logo, brand colour, bank details you choose to print on invoices.
• Documents and records: quotations, invoices, receipts, line items, hidden cost lines, payments and activity history.
• Customer details you enter, and a customer's name if they accept a quote.
• Payment provider connection details: your secret keys are encrypted before storage and are never shown back to anyone.
• Payment results from providers (amount, currency, reference, status). We do not receive or store card numbers; customers enter those on the provider's own page.
• Basic technical data such as IP address and browser type, used for security, preventing abuse and fixing problems.
• How you use the app: which screens you use and for how long (counted only while you're active). We don't record what you type or what's on the screen.
• Messages you send us from Ideas & help, with your name, email and the screen you sent it from.
• AI assistants you connect: which app, which business, its access level and when it was last used (see section 5).

3. Why we use it

• To provide Usetally: create your documents, send them, show your customers their link, and record payments (to perform our contract with you).
• To bill you for your Usetally plan (contract).
• To keep Usetally secure and prevent fraud (legitimate interests and legal obligations).
• To send service emails such as sign-up confirmation, password resets, invitations and documents you choose to send (contract).
• To answer support requests and feature ideas (legitimate interests).
• To understand which parts of Usetally are used, so we know what to improve (legitimate interests).

We don't sell personal data, and we don't use your customers' data for our own marketing.

4. Who we share it with

Only with service providers who help us run Usetally, under agreements that protect the data. The full, current list is on our sub-processors page.

• Hosting and database (for example Supabase and Vercel), which store and serve the app and its data.
• Email delivery providers, to send account emails and the documents you choose to email.
• Payment providers you connect (Stripe, Paystack, Flutterwave or Bachs), to take payments for you, and the provider we use to bill Usetally plans.
• Authorities, where the law requires it.

5. Apps and AI assistants you connect

You can connect AI assistants such as ChatGPT, Claude or Grok to a business in Settings → AI & MCP. You sign in to Usetally, choose the business, and choose View only or Full access. A connected assistant can see, and with Full access create and change, what your team role allows: business details, quotes, invoices, receipts, payments, products and prices, and your customers' names, emails, phone numbers and addresses. Hidden costs are included only if your role can see them.

Information you ask an assistant to fetch is sent to that assistant's provider (for example OpenAI, Anthropic or xAI), which handles it under its own terms and privacy policy. You choose to connect these services, so they are not Usetally's sub-processors. Only connect them if you have the right to share your customers' details with them.

We keep a record of each connection: which app, which business, who connected it, its access level and when it was last used. Sign-in tokens are stored only in a form that can't be turned back into the token, and access tokens expire after one hour. You can disconnect at any time, which ends access straight away. Documents an assistant created stay in your account, marked with the assistant's name.

6. International transfers

Some of our providers store or process data outside Nigeria (for example in the EU or the US). When that happens we rely on safeguards permitted by the Nigeria Data Protection Act, such as contractual protections and providers with recognised security standards.

7. How long we keep it

We keep your account and business records while your account is open, so your documents and receipts remain available. When an owner deletes a business, it and everything in it (customers, documents, payments, receipts, logo) is permanently deleted 30 days later; backups expire shortly after. When you delete your own account, your login and profile are removed immediately. We keep records of payments made to Usetally for plans for 6 years, as Nigerian tax law requires.

8. How we protect it

• Each business's data is separated at the database level, so one business can't read another's records.
• Hidden cost lines are only visible to team members allowed to see them.
• Payment provider keys are encrypted at rest, and all traffic uses HTTPS.
• Customer document links use long random codes that can't be guessed.

9. Your rights

You can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Most of this you can do yourself: edit your details in the app, and in Settings → Privacy & data download a complete copy of your data or delete your business or account. For anything else, email us and we'll reply within 30 days. If you're one of our users' customers, contact that business first; we'll help them respond. You can also complain to the Nigeria Data Protection Commission (or your local data protection authority).

10. Cookies

Usetally uses essential cookies to keep you signed in and secure. Your light or dark display choice is saved in your browser. We don't use advertising cookies.

11. Children

Usetally is for businesses and isn't meant for anyone under 18.

12. Changes

We may update this policy. If a change is significant, we'll tell you by email or in the app.

13. Contact

Privacy questions or requests: ibroakoss@gmail.com.